CVE-2025-49796

CRITICAL
INFO Priority: 0.15 BB Relevance: 79/100
Published: 2025-06-16 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: Unchanged
C: None
I: High
A: High

Description

A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
— — 0 < 2.15.0

References & Advisories (35)

https://access.redhat.com/errata/RHSA-2025:10630
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:10698
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:10699
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:11580
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12098
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12099
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12199
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12237
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12239
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12240
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:12241
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:13267
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:13335
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:15397
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:15827
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:15828
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:18217
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:18218
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:18219
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:18240
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:19020
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:19041
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:19046
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:19894
vendor-advisory x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2025:21913
vendor-advisory x_refsource_REDHAT
Showing 25 of 35 references

Bug Bounty Relevance

79 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

9.1 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS — Exploitation Probability

1.62%
Raw Score 0.016250
Percentile 76.6%
Date 2026-11-14

EPSS Trend

2026-11-14
0.01625
2026-11-13
0.01625
2026-11-12
0.01625
2026-11-10
0.01558
2026-11-09
0.01558
2026-11-08
0.01558
2026-11-07
0.01558
2026-11-06
0.01558
2026-11-05
0.01558
2026-11-04
0.01558

Intelligence Sources

mitre ref →
nvd ref →